Closed davidcr01 closed 5 months ago
Working on https://github.com/wazuh/wazuh-automation/issues/1485, I have noticed that there is a warning message generated in the RPM-based system when removing the Wazuh installation.
[root@amazonlinux21 vagrant]# bash wazuh-install.sh -u -v 02/04/2024 10:28:37 DEBUG: Checking root permissions. 02/04/2024 10:28:37 DEBUG: Checking sudo package. 02/04/2024 10:28:37 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0 02/04/2024 10:28:37 INFO: Verbose logging redirected to /var/log/wazuh-install.log 02/04/2024 10:28:37 DEBUG: YUM package manager will be used. 02/04/2024 10:28:37 DEBUG: Checking system distribution. 02/04/2024 10:28:37 DEBUG: Detected distribution name: rhel 02/04/2024 10:28:37 DEBUG: Detected distribution version: 9 02/04/2024 10:28:37 DEBUG: Checking Wazuh installation. 02/04/2024 10:28:37 DEBUG: There are Wazuh remaining files. 02/04/2024 10:28:37 DEBUG: There are Wazuh indexer remaining files. 02/04/2024 10:28:37 DEBUG: There are Filebeat remaining files. 02/04/2024 10:28:37 DEBUG: There are Wazuh dashboard remaining files. 02/04/2024 10:28:37 INFO: Removing Wazuh manager. Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use subscription-manager to register. Dependencies resolved. ================================================================================ Package Architecture Version Repository Size ================================================================================ Removing: wazuh-manager x86_64 4.8.0-1 @wazuh 879 M Transaction Summary ================================================================================ Remove 1 Package Freed space: 879 M Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Running scriptlet: wazuh-manager-4.8.0-1.x86_64 1/1 Erasing : wazuh-manager-4.8.0-1.x86_64 1/1 warning: file /var/ossec/tmp/vd_1.0.0_vd_4.8.0.tar.xz: remove failed: No such file or directory warning: /var/ossec/etc/ossec.conf saved as /var/ossec/etc/ossec.conf.rpmsave Running scriptlet: wazuh-manager-4.8.0-1.x86_64 1/1 Verifying : wazuh-manager-4.8.0-1.x86_64 1/1 Installed products updated. Removed: wazuh-manager-4.8.0-1.x86_64 Complete! 02/04/2024 10:29:18 INFO: Wazuh manager removed. 02/04/2024 10:29:18 INFO: Removing Wazuh indexer. Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use subscription-manager to register. Dependencies resolved. ================================================================================ Package Architecture Version Repository Size ================================================================================ Removing: wazuh-indexer x86_64 4.8.0-1 @wazuh 1.0 G Transaction Summary ================================================================================ Remove 1 Package Freed space: 1.0 G Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Running scriptlet: wazuh-indexer-4.8.0-1.x86_64 1/1 Stopping wazuh-indexer service... OK Erasing : wazuh-indexer-4.8.0-1.x86_64 1/1 warning: /etc/wazuh-indexer/opensearch.yml saved as /etc/wazuh-indexer/opensearch.yml.rpmsave warning: /etc/wazuh-indexer/opensearch-security/internal_users.yml saved as /etc/wazuh-indexer/opensearch-security/internal_users.yml.rpmsave warning: /etc/wazuh-indexer/jvm.options saved as /etc/wazuh-indexer/jvm.options.rpmsave Running scriptlet: wazuh-indexer-4.8.0-1.x86_64 1/1 Verifying : wazuh-indexer-4.8.0-1.x86_64 1/1 Installed products updated. Removed: wazuh-indexer-4.8.0-1.x86_64 Complete! 02/04/2024 10:29:21 WARNING: The Wazuh indexer package could not be removed. 02/04/2024 10:29:21 INFO: Removing Filebeat. Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use subscription-manager to register. Dependencies resolved. ================================================================================ Package Architecture Version Repository Size ================================================================================ Removing: filebeat x86_64 7.10.2-1 @wazuh 70 M Transaction Summary ================================================================================ Remove 1 Package Freed space: 70 M Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Erasing : filebeat-7.10.2-1.x86_64 1/1 warning: /etc/filebeat/filebeat.yml saved as /etc/filebeat/filebeat.yml.rpmsave Running scriptlet: filebeat-7.10.2-1.x86_64 1/1 Verifying : filebeat-7.10.2-1.x86_64 1/1 Installed products updated. Removed: filebeat-7.10.2-1.x86_64 Complete! 02/04/2024 10:29:23 WARNING: The Filebeat package could not be removed. 02/04/2024 10:29:23 INFO: Removing Wazuh dashboard. Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use subscription-manager to register. Dependencies resolved. ================================================================================ Package Architecture Version Repository Size ================================================================================ Removing: wazuh-dashboard x86_64 4.8.0-1 @wazuh 902 M Transaction Summary ================== ============================================================== Remove 1 Package Freed space: 902 M Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64 1/1 Stopping wazuh-dashboard service... Erasing : wazuh-dashboard-4.8.0-1.x86_64 1/1 warning: /etc/wazuh-dashboard/opensearch_dashboards.yml saved as /etc/wazuh-dashboard/opensearch_dashboards.yml.rpmsave Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64 1/1 Verifying : wazuh-dashboard-4.8.0-1.x86_64 1/1 Installed products updated. Removed: wazuh-dashboard-4.8.0-1.x86_64 Complete! 02/04/2024 10:29:37 WARNING: The Wazuh dashboard package could not be removed. 02/04/2024 10:29:37 DEBUG: Removing GPG key from system.
Notice that the packages are removed but the Installation assistant warns that they could not be removed:
02/04/2024 10:29:23 INFO: Removing Wazuh dashboard. Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use subscription-manager to register. Dependencies resolved. ================================================================================ Package Architecture Version Repository Size ================================================================================ Removing: wazuh-dashboard x86_64 4.8.0-1 @wazuh 902 M Transaction Summary ================== ============================================================== Remove 1 Package Freed space: 902 M Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64 1/1 Stopping wazuh-dashboard service... Erasing : wazuh-dashboard-4.8.0-1.x86_64 1/1 warning: /etc/wazuh-dashboard/opensearch_dashboards.yml saved as /etc/wazuh-dashboard/opensearch_dashboards.yml.rpmsave Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64 1/1 Verifying : wazuh-dashboard-4.8.0-1.x86_64 1/1 Installed products updated. Removed: wazuh-dashboard-4.8.0-1.x86_64 Complete! 02/04/2024 10:29:37 WARNING: The Wazuh dashboard package could not be removed.
This happens only in RPM-based systems, as investigated in the mentioned issue. And it happens with every removed component.
Description
Working on https://github.com/wazuh/wazuh-automation/issues/1485, I have noticed that there is a warning message generated in the RPM-based system when removing the Wazuh installation.
Notice that the packages are removed but the Installation assistant warns that they could not be removed:
This happens only in RPM-based systems, as investigated in the mentioned issue. And it happens with every removed component.
Tasks